A policy information point (PIP) is the component of an access control system that supplies the data a policy decision point (PDP) needs to evaluate a request. It retrieves attributes about the user, the resource and the environment, such as role, department, device state, location or time of day, from the systems that hold them and returns them to the PDP on demand.
The PIP does not store policies or make decisions. Policies live in the policy administration point (PAP), the PDP evaluates them and the policy enforcement point (PEP) applies the result. The PIP's job is to supply the PDP with current information from the systems that own it.
A policy can only be as good as the data behind it. A rule like "allow access to payroll data only for HR managers on a compliant device during business hours" needs four facts to evaluate: the user's role, the user's department, the device's compliance state and the current time. None of that is in the policy itself. The PIP fetches each fact from its source, such as the HR system, the identity directory, the endpoint management tool and the system clock, and hands them to the PDP in the form the policy expects.
A PIP handles each request in five steps:
The PDP receives an access request from the PEP and identifies which attributes the applicable policies need.
The PDP queries the PIP for the attributes it doesn't already have.
The PIP retrieves them from the authoritative sources: directories, HR systems, device management, threat intelligence feeds or other databases.
The PIP returns the attributes to the PDP, which evaluates the policy and returns its decision to the PEP.
The PEP enforces the decision.
Policies are most useful when they're evaluated against current data. A PIP connects the PDP to the systems of record, so a change in the HR system, a device falling out of compliance or a login from an unexpected location can change the next decision without anyone editing a policy. That's what makes attribute-based access control (ABAC) and context-aware access control possible in practice.
The PIP also keeps attribute data out of the policy. Policies stay readable and useable; the facts they depend on stay in the systems that own them.
How Policy-based Access Control Improves Agility and Security